TWI724683B - Computer-implemented method for managing user key pairs, system for managing user key pairs, and apparatus for managing user key pairs - Google Patents

Abstract

Disclosed herein are methods, systems, and apparatus, including computer programs encoded on computer storage media, for managing cryptographic keys based on user identity information. One of the methods includes receiving a request to store identity information and a user key pair to a memory on a chip, the request being digitally signed with a digital signature, the identity information uniquely identifying the user, and the user key pair being assigned to the user; determining that the digital signature is authentic based on a public key pre-stored in the memory; encrypting the identity information and the user key pair; and storing the identity information and the user key pair to the memory.

Description

Computer-implemented method for managing user key pairs, system for managing user key pairs, and device for managing user key pairs

This article is about identity authentication technology and data security.

Identity authentication technology is usually used in computer networks to verify user identity and ensure data security. Like other information stored or transmitted digitally in a computer network, identity information can be represented by a data set. Computers can identify and authenticate users based on their digital identities. For data security, it is important to ensure that the digital identity belongs to an authorized user, or in other words, the digital identity matches the user's actual identity.

With the development of technology, decentralized systems such as blockchain networks and Internet of Things (IoT) networks have emerged. Under the decentralized system, individuals can safely store their own identity information. For example, a user can hold a digital wallet, which stores the user can use to add a digital signature Zhang Yi authorizes the private key for transactions on blockchain networks or IoT devices. The private key is usually stored on the computing device as a data string with encryption semantics, and is intended to be accessed only by the user. Like other data strings, private keys can potentially be copied and shared. Any user with a private key can control the digital assets associated with the private key. In addition, if the private key is lost, the digital asset cannot be retrieved. Therefore, safe storage and effective use of cryptographic keys will be important.

It is desired to develop a key management technology that can effectively verify the user's identity information and safely manage the user's password key.

This article describes a technique for managing the user password key assigned to a user based on the identity information that uniquely identifies the user. These technologies generally involve the receipt of identity information and user password keys by an identity encryption chip (ICC). The identity information and user password keys are digitally signed with a digital signature, which is assigned to the master user’s private key Generated, based on the public key assigned to the main user to determine that the digital signature is credible, the public key is pre-stored in the memory on the ICC, and the identity information and user password key are encrypted and stored in the memory .

This document also provides one or more non-transitory computer-readable storage media coupled to one or more processors and storing instructions thereon. When the instructions are executed by the one or more processors, the The instructions will cause the one or more processors to perform operations in accordance with the embodiments of the methods provided herein.

This article also provides a system for implementing the methods provided herein. The system includes one or more processors and a computer-readable storage medium coupled to the one or more processors and storing instructions thereon. When the instructions are executed by the one or more processors, The instructions will cause the one or more processors to perform operations in accordance with the embodiments of the methods provided herein.

It should be understood that the methods according to this document can include any combination of the aspects and features described herein. That is to say, the method according to this document is not limited to the combination of the aspects and features specifically described herein, but also includes any combination of the provided aspects and features.

The details of one or more embodiments herein are set forth in the drawings and description below. According to the specification and drawings and the scope of patent application, other features and advantages of this article will be obvious.

100: Identity Encryption Chip (ICC)

102: memory

104: Logic Computing Components

110: Step

112: Step

114: step

116: step

120: Step

122: step

124: Step

125: step

126: Step

128: steps

130: steps

132: Step

134: Step

200: processing

202: Step

204: Step

206: Step

208: Step

210: Step

212: Step

214: Step

300: Treatment

302: Step

304: Step

306: Step

308: step

310: Step

400: processing

402: step

404: Step

406: Step

408: step

410: Step

412: step

500: key management device

504: Key Management

506: storage

508: write

510: Randomly Generated

512: delete

514: Algorithm Management

516: Identity Verification Algorithm

518: Digital Signature Verification Algorithm

520: encryption/decryption algorithm

522: Scepter Algorithm

524: Input Management

526: Algorithm input

528: Identity Information Input

530: Password key input

532: Digital Signature

534: Identity Verification

600: step

602: step

604: step

606: step

608: step

700: Device/identity encryption chip

702: request receiving module

704: Digital Signature Authentication Module

706: Encryption Module

708: Storage Module

[Fig. 1] is a diagram showing an example of an identity encryption chip for executing processing that can be used to perform the embodiments of this document.

[FIG. 2] is a flowchart showing an example of initialization processing for an identity encryption chip according to an embodiment of this document.

[FIG. 3] is a flowchart showing an example of processing for inputting information to an identity encryption chip according to an embodiment of this document.

[FIG. 4] is a flowchart showing an example of a process of performing an encryption operation using an identity encryption chip according to an embodiment of this document.

[FIG. 5] is a diagram showing a key management device according to an embodiment of this document Example diagram.

[Figure 6] depicts an example of a method that can be performed according to the embodiments herein.

[Fig. 7] An example of the module of the device according to the embodiment of this document is depicted.

The same drawing symbols and names in the drawings indicate the same elements.

This article describes a technique for managing the user password key assigned to a user based on the identity information that uniquely identifies the user. These technologies generally involve the receipt of identity information and user password keys by an identity encryption chip (ICC). The identity information and user password keys are digitally signed with a digital signature generated by the private key assigned to the main user, based on the distribution The public key given to the main user confirms that the digital signature is trustworthy. The public key is pre-stored in the memory on the ICC, and the identity information and user password key are encrypted and stored in the memory.

FIG. 1 is a diagram showing an example of an ICC 100 for performing processing that can be used to perform the embodiments herein. At a higher level, the ICC 100 may be a computer chip including a memory 102 and a logic computing element 104. The ICC 100 can be used to perform encryption operations securely. In some embodiments, the ICC 100 may be a wafer set including one or more wafer assemblies. The memory 102 and the logic computing element 104 can be integrated into different chip components. In some embodiments, the memory 102 can be used to provide permanent storage. In some examples, the memory 102 may be a programmable read-only memory (PROM), which allows The data is written once and only read only afterwards. In some examples, the memory 102 may be an electrically erasable programmable read-only memory (EEPROM) or a flash memory, which can be reformatted and reprogrammed. In some embodiments, the logic computing element may be a dedicated integrated circuit (ASIC) or a single chip microcomputer (SCM).

In some computer networks, cryptography is implemented to maintain the privacy of data or transactions. For example, if two users want to maintain transaction privacy so that other users cannot distinguish the details of the transaction, the user can encrypt the transaction data. Exemplary encryption operations include, but are not limited to, symmetric key cryptography and asymmetric key cryptography. Symmetric encryption refers to an encryption process that uses a single key to both encrypt (generate ciphertext from plaintext) and decrypt (generate plaintext from ciphertext).

Asymmetric encryption uses key pairs. Each key pair includes a private key and a public key. The private key is only known to the corresponding user, and the public key can be publicly distributed. The user can use another user's public key to encrypt data, and the encrypted data can be decrypted using the other user's private key.

Asymmetric encryption can be used to provide a digital signature, which enables participants in a transaction to confirm other participants in the transaction and the validity of the transaction. For example, a user can digitally sign a message, and another user can confirm that the message was sent by the user based on the digital signature. Digital signatures can also be used to ensure that messages are not tampered with during transmission. For example, user A will send a message to user B. User A generates a hash value of the message, and then uses his private key to encrypt the hash value to provide a digital signature that is the encrypted hash value. User A attaches a digital signature to the message, and sends the message with the digital signature to user B. User B uses User A's public key to decrypt the digital signature and extract the hash value. User B hashes the message and compares the hash value. If the hash value is the same, user B can confirm that the message is indeed from user A and has not been tampered with.

The ICC 100 can be used to perform encryption operations securely based on verifying user identity information. The memory 102 can be used to store trusted user identity information and password key information. The memory 102 can also store an identity authentication algorithm (for example, as a computer executable code) and an encryption operation algorithm (for example, as a computer executable code). In some embodiments, the information and algorithms stored in the memory 102 are encrypted to prevent leakage even when the ICC 100 is reverse engineered. When receiving a request to perform an encryption operation from the user, the logical computing component 104 can use the identity information collected from the user and the trusted user identity information stored in the memory 102 to verify the identity of the user based on the identity authentication algorithm . For example, if the identity information is a fingerprint image of a user's fingerprint, the identity authentication algorithm may be a local authentication algorithm, which compares the fingerprint image collected from the user with the stored fingerprint image. If the collected fingerprint image matches the stored fingerprint image, the user's identity is successfully verified. Then, the logical computing component 104 can use the stored cryptographic key information to perform the requested encryption operation. After the encryption operation is performed, the operation result can be output by the ICC 100. By using ICC 100, it is possible to perform encryption operations only after verifying or authenticating the user's identity. In this way, the user's permission to perform operations can be guaranteed. In addition, since the cryptographic key is stored in the ICC 100 as cipher text, it is encrypted The operation is performed inside the ICC 100. Only the operation result is output from the ICC 100. In this way, the security of the cryptographic key can be ensured.

In some embodiments, the master user of the ICC 100 can use a public authorization key to provide the user with access to the ICC 100. The main user can be an administrator of the ICC 100, a network system administrator, an owner, or a publisher. In short, the master user is the user who controls the ICC 100, and the authorization key pair is assigned to the master user. The authorization key pair includes a public authorization key and a private authorization key. The public authorization key and the private authorization key enable the master user (or the ICC 100 executing on behalf of the master user) to participate in asymmetric encrypted communication and/or perform encryption operations ( For example, encryption, decryption). At 110, the public authorization key is written into the ICC 100.

At 112, the memory content is erased and the public authorization key is written into the memory 102. In some embodiments, the memory 102 is permanent memory. In some embodiments, in order to prevent tampering, the public authorization key can only be written into the storage unit of the memory 102 once. If a new public license key needs to be used to replace the existing public license key, the content of the memory 102 can be erased before the new public license key is written. In some embodiments, the public authorization key may be encrypted before writing the public authorization key to the memory 102 to enhance security.

At 114, the user's identity information and the user's password key pair are input into the ICC 100. The cryptographic key pair includes a public user key and a private user key. The public user key and the private user key enable the user (or the computing device executing on behalf of the user) to participate in asymmetric encrypted communication and/or perform encryption operations (for example, encryption , Decrypt). In some embodiments, the identity information can be used Biometric information of the household. Examples of biometric information include, but are not limited to, fingerprint, voiceprint, heartbeat, and iris information. At 116, a digital signature can be added to the identity information and password key pair. In some embodiments, the master user can add a digital signature to the entered identity information and password key pair. The private authorization key assigned to the master user can be used to generate a digital signature. In some embodiments, the private authorization key may also be issued by the master user to the trusted user. Trusted users can use the private authorization key to directly sign the identity information and the password key pair. At 118, the public authorization key is read from the memory 102 to verify the digital signature at 120. If the verification is successful, it is determined that the user is authorized to use the ICC 100 to perform encryption operations.

At 122, the identity information and the password key pair are written into the memory 102 for storage. In some embodiments, the identity information and the password key may be encrypted before being written into the memory 102 to enhance security. In some embodiments, the public authorization key can be used to encrypt the identity information and the cryptographic key pair. In some embodiments, the identity information and the cryptographic key pair can be written into a separate storage unit of the memory 102.

At 124, the user sends a request to perform an encryption operation to ICC 100. In some embodiments, the data to be encrypted can also be sent to the ICC 100. For example, if the encryption operation is encryption, the corresponding data may be a data file to be encrypted. At 125, the user's identity information is collected and sent to the ICC 100. At 126, the identity information written in the memory 102 at 122 is read from the memory 102 to perform identity verification at 128. Identity verification can be performed based on comparing the identity information received at 125 with the stored identity information. If the identity information matches, it will be verified as Then, the cryptographic key information is read from the memory 102 at 130 to perform the encryption operation at 132. If the identity information does not match, the verification is unsuccessful, and the request to perform the encryption operation can be rejected. In some embodiments, an identity verification algorithm may be used to perform identity verification based on the received specific type of identity information. In some embodiments, encryption operations may be performed based on encryption operation algorithms. As mentioned above, the encryption operation can be encryption, decryption or adding a digital signature to the data. After the encryption operation is performed, the operation result may be output at 134.

As described above, the ICC 100 can create a trusted environment in the hardware so that authorized users can perform encryption operations securely. For example, a master user who owns the ICC 100 can authorize multiple users to store their identity information and password key pairs in the ICC 100. The information requested by the user to be stored is digitally signed by the master user’s private authorization key. The authenticity of the digital signature can be verified through the public authorization key of the master user, and the public authorization key of the master user is pre-stored in the ICC 100. If the digital signature is trusted, the corresponding identity information and password key pair can be stored in the ICC 100.

When a user requests an encryption operation, the ICC 100 can retrieve the identity information and password key pair of a specific user from the memory. The identity information can be used to verify the user's identity, and the password key pair can be used to perform the requested encryption operation after verifying the user's identity. Encryption operations can be performed for various practical scenarios. For example, the encryption operation may be an operation of adding a digital signature to a blockchain transaction. In this example, node A (for example, a computing device operating on behalf of a user) may be a computing device in a blockchain network, which initiates a request for digital signature of blockchain transaction data with node B. Block The chain transaction data can be a hash value of the transaction data between node A and node B. Node A can use ICC 100 to generate a digital signature of the hashed transaction data. In order to use the ICC 100, the identity information associated with the node A is collected and compared with the identity information stored in the ICC 100. If the collected identity information matches the stored identity information, the node A can be authorized to use the ICC 100 to perform encryption operations. More specifically, the private key in the cryptographic key pair can be read from the memory of the ICC 100 to generate a digital signature of the hashed transaction data. Then, node A can send the hashed transaction data with a digital signature to node B. Node B uses the public key in the cryptographic key pair to decrypt the digital signature and extract the hash value. Node B hashes the message and compares the hash value. If the hash value is the same, node B can confirm that the message is indeed from node A and has not been tampered with.

FIG. 2 is a flowchart showing an example of a process 200 for ICC initialization according to an embodiment of this document. In some embodiments, the ICC is initialized by a master user such as an administrator, a network system administrator, or a publisher of the ICC. In some embodiments, the master user can control which users are authorized to use ICC to perform encryption operations securely.

At 202, the ICC is reset. In some embodiments, the ICC is reset in response to receiving a request to enter the public authorization key. In some embodiments, resetting the ICC may include erasing the content stored in the memory of the ICC or reformatting it. In some embodiments, resetting the ICC may also include resetting or resetting the setting of the logic calculation element of the ICC to a preset value. By resetting the ICC, you can ensure that a public authorization key is used to control the input to ICC information. In addition, any identity information and password key pairs previously stored in ICC are erased to ensure data security. In some embodiments, the ICC is a new ICC and is used for the first time, and the ICC can be initialized to accept the input of the public authorization key. In some embodiments, the public authorization key may be a public key generated by the master user's private authorization key for verifying the digital signature.

At 204, the ICC receives the public authorization key. In 206, the public license key input function is called to input the public license key into the memory. At 208, it is determined whether the memory of the ICC is a one-time programmable (OTP) memory. OTP memory only allows data to be written to the memory once. When the main user inputs a new public authorization key to ICC, any previously stored identity information and password key pair can be erased to ensure that the new public authorization key does not control the user who has previously entered the information. Therefore, if the memory is OTP, the public authorization key can be encrypted at 212 and the encrypted public authorization key can be input to the memory. Otherwise, before the public authorization key is encrypted and entered into the memory, the contents of the memory are cleared at 210. After 212, the process 200 ends at 214.

FIG. 3 is a flowchart showing an example of a process 300 for inputting information into an ICC according to an embodiment of this document. After initializing the ICC, the master user can authorize the user to save the corresponding identity information and password key pair to the ICC. In this way, authorized users can use ICC to perform encryption operations securely.

At 302, the ICC receives the identity information and the cryptographic key pair. In some embodiments, the identity information may be received by a computing device communicatively coupled with the ICC. set. Exemplary computing devices may include IoT devices, smart bracelets, smart watches, laptop computers (or desktop computers), and smart phones. In some embodiments, the identity information may be biometric information of the user, such as fingerprint, voiceprint, heartbeat, and iris information. The computing device may include a fingerprint sensor, a microphone, a heartbeat sensor, or an iris scanner to collect biometric information. For example, the computing device may be a smart watch that can collect the user's heartbeat information. The heartbeat information can be used to identify the user's identity information. After collecting the identity information, it can be sent to the ICC together with the user's password key pair. In some embodiments, the ICC may communicate wirelessly with the computing device based on wireless communication protocols such as Bluetooth, Near Field Communication (NFC), Wi-Fi, or cellular data. In some embodiments, the ICC can be plugged into or integrated into the computing device to perform wired communication with the computing device.

At 304, the digital signature is added to the identity information and password key pair. In some embodiments, the master user can add a digital signature to the identity information and password key pair belonging to the authorized user. The private key used to generate the digital signature may be a private authorization key. The private authorization key belongs to the same key pair as the public authorization key stored in the ICC during the ICC initialization process 200 as discussed in the description of FIG. 2.

At 306, the digital signature is verified based on the public authorization key. If the digital signature is correct, the identity information and password key pair are encrypted at 308, and the encrypted identity information and password key pair are stored in the memory of the ICC. After that, the process 300 ends at 310. If the digital signature is incorrect, the request is rejected and the process 300 ends at 310. After the user’s identity information and password key pair are entered into ICC, the user can use ICC To perform encryption operations securely.

FIG. 4 is a flowchart showing an example of a process 400 for performing an encryption operation using ICC according to an embodiment of this document. At 402, a request to perform an encryption operation is received. Examples of encryption operations can include data encryption, data decryption, and adding digital signatures.

At 404, the user's identity information is received. As discussed in the description of FIG. 3, the identity information can be collected by the computing device and sent to the ICC. At 406, the identity information can be verified. In some embodiments, the identity information can be compared with the identity information stored in the memory of the ICC. If the identity information matches the stored identity information, the verification is successful, and the cryptographic key pair stored in the memory of the ICC can be used to perform the requested encryption operation at 408. Otherwise, the process 400 ends at 412. After 408, the process 400 proceeds to 410, where the operation result is returned. The result of the operation may depend on the encryption operation performed at 408. For example, if the encryption operation is file encryption, the file encrypted with the user's public key can be returned. Similarly, if the encryption operation is file decryption, the file decrypted using the user's private key can be returned. If the encryption operation is to add a digital signature, the private key is used to generate a file with the user's digital signature, and the file is returned. After 410, processing ends at 412.

FIG. 5 is a diagram showing an example of a key management device 500 according to an embodiment of this document. In some embodiments, the key management device 500 may manage the cryptographic key pair used by the ICC to perform the encryption operation for the user. The key management device 500 can perform key management 504 and algorithm management 514. Key management 504 can include storage 506, writing 508, random The machine generates 510 and deletes 512. The cryptographic key may include an asymmetric key pair (including a public authorization key) associated with the master user and a cryptographic key pair associated with an authorized user of the ICC to perform encryption operations.

The algorithms managed by the algorithm management 514 may include storage and management of an identity verification algorithm 516, a digital signature verification algorithm 518, an encryption and decryption algorithm 520, and a token algorithm 522. The identity verification algorithm 516 may be used to perform identity verification as discussed in the description of step 406 in FIG. 4. As described herein, the digital signature verification algorithm 518 can be used to perform digital signature verification. As described herein, the encryption and decryption algorithm 520 can be used to perform the requested encryption operation. For example, if the requested encryption operation is an encryption operation on a user file, the encryption and decryption algorithm 520 can be executed to retrieve the user's public key from the memory of the ICC and encrypt the user file. The token algorithm 522 can be used to manage tokens, which indicate the time limit or the number limit for performing the requested encryption operation without verifying the user's identity. In some embodiments, a token can be generated and temporarily stored in the memory of the ICC. The token can provide the following authorization: perform multiple encryption operations or perform encryption operations within a predetermined period of time without verifying the user's identity. For example, tokens can be generated to provide ICC users with the following authorization: add a digital signature to the next five files received or to files received within the next three hours, regardless of which one is satisfied first condition. In some embodiments, the token can be cleared and removed from the ICC when it expires or is used up.

In some embodiments, the key management device 500 can be used as a backup of ICC. Even if the ICC is lost or destroyed, it can be checked from the key management device 500 Ask for the cryptographic key and algorithm used to perform the encryption operation.

In some embodiments, the key management device 500 can also perform input management 524. The key management device 500 can be communicably coupled to the ICC to manage the algorithm input 526, the identity information input 528, the password key input 530, the digital signature generation 532, and the identity verification 534.

Figure 6 depicts an example of a method 600 that can be performed according to embodiments herein. For clarity of presentation, the following description generally describes the method 600 in the context of other figures in this document. However, it should be understood that the method 600 can be executed by any suitable system, environment, software and hardware, or a combination of systems, environments, software and hardware, for example. In some embodiments, the various steps of method 600 may be executed in parallel, combined, looped, or in any suitable order. In some embodiments, the method 600 may be performed by the ICC described according to the embodiments herein.

At 602, a request to store the identity information and the user key pair in the memory on the ICC is received. The request is digitally signed with a digital signature. The identity information uniquely identifies the user, and the user key pair is Assign to users. In some embodiments, the ICC is initialized by pre-storing the public authorization key and the private authorization key. The public authorization key and the private authorization key are an asymmetric key pair assigned to the master user of the ICC. In some embodiments, initializing the ICC further includes storing an executable identity authentication code to authenticate the user based on the identity information. In some embodiments, initializing the ICC includes: storing a first encryption operation code, the first encryption operation code can be executed to add a digital signature based on the private authorization key; and storing a second encryption operation code, the first encryption operation code Two encrypted opcodes can be executed to be based on the user Key pair to perform file encryption or file decryption.

In some embodiments, the request for storing the identity information and the user key pair is the first request, the identity information is the first identity information, the digital signature is the first digital signature, and the computer-implemented method further includes: receiving The second identity information and the second request for adding the second digital signature to the file; based on the second identity information matching the first identity information to verify that the second request is authentic; and based on the first encryption operation code and user money The private key in the key pair adds the second digital signature to the file. In some embodiments, the request for storing the identity information and the user key pair is the first request, the identity information is the first identity information, and the method 600 further includes: receiving the second identity information and a file for encrypting or decrypting the file. The second request; verify that the second request is authentic based on the match between the second identity information and the first identity information; and execute based on the second request, the second encryption operation code, and the public key or the private key in the user key pair Encrypt or decrypt. In some embodiments, the identity information is biometric information associated with the user.

At 604, it is determined that the digital signature is authentic based on the public authorization key pre-stored in the memory. In some embodiments, the memory is programmable read-only memory (PROM), electrically erasable PROM, or flash memory, and wherein the identity information and user key pair are stored in a separate storage unit of the memory .

At 606, the identity information and the user key pair are encrypted. At 608, the identity information and the user key pair are stored in the memory.

FIG. 7 depicts an example of the modules of the apparatus 700 according to the embodiments herein. The apparatus 700 may be an example of an embodiment of ICC. The device 700 can In accordance with the above embodiment, the device 700 includes the following: a request receiving module 702 for receiving a request for storing identity information and a user key pair into the memory on the ICC, the request being digitally signed Signature, the identity information uniquely identifies the user, and the user key pair is assigned to the user. The digital signature authentication module 704 determines that the digital signature is credible based on the public authorization key stored in the memory in advance. The encryption module 706 is used to encrypt the identity information and the user key pair. The storage module 708 is used to store the identity information and the user key pair in the memory.

In an alternative embodiment, the device 700 includes a chip initialization module for initializing the ICC by pre-storing a public authorization key and a private authorization key corresponding to the public authorization key. The public authorization key and the private authorization key are an asymmetric key pair assigned to the master user of the ICC.

In an alternative embodiment, the memory is programmable read-only memory (PROM), electrically erasable PROM, or flash memory, and wherein the identity information and the asymmetric key pair are stored in separate storage of the memory Unit. In an alternative embodiment, the identity information is biometric information.

The systems, devices, modules, or modules shown in the previous embodiments can be realized by using computer chips or entities, or can be realized by using products with specific functions. A typical embodiment device is a computer. The computer may be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an e-mail receiving and sending device, a game console, Tablets, wearable devices, or any combination of these devices.

For the embodiment processing of the function and role of each module in the device, you can Take the embodiment with reference to the corresponding step in the previous method for processing. For simplicity, details are omitted here.

Since the device embodiment basically corresponds to the method embodiment, for related parts, reference may be made to the relevant description in the method embodiment. The previously described device embodiments are only examples. Modules described as separate parts may or may not be physically separated, and parts shown as modules may or may not be physical modules, may be located in one location, or may be distributed across multiple network modules. Some or all modules can be selected based on actual needs to achieve the goals of the solution in this article. A person of ordinary skill in the art can understand and implement the embodiments of the present application without creative work.

The techniques described in this article produce several technical effects. For example, embodiments of the subject matter allow the master user to control and grant permission to use ICC to other users. Authorization can be given by adding a digital signature to the authorized user’s identity and password key information using the master user’s private key. If the digital signature cannot be authenticated by the public authorization key of the main user pre-stored in the ICC, the ICC will reject the input of the identity and password key information.

In order to request the ICC to perform an encryption operation, the user's identity information needs to be collected, and the collected identity information is verified as authentic by the identity information previously authenticated and stored in the ICC. In this way, it can be ensured that the user requesting the encryption operation is an authorized user.

In addition, the identity information and password keys can be encrypted before being stored in the memory of the ICC. The information is only decrypted in the ICC to perform the corresponding identity verification and encryption operations. The encryption operation is performed inside the ICC, and only the operation result is output from the ICC. Therefore, user identity information and password keys are safe Yes, even if ICC is hacked or reverse engineered, it will not be leaked. In some embodiments, the key management device can be used to store the identity information and the password key in cipher text to provide backup to the ICC and further enhance data security.

Computing devices can be used to collect user identity information and initiate requests for encryption operations. ICC can communicate wirelessly with computing devices through various communication protocols, or it can be integrated or plugged into computing devices so as to be easily used for secure encryption operations.

The subjects, actions, and operation embodiments described in this document can be implemented in digital electronic circuits, tangible computer software or firmware, computer hardware, including the structures disclosed herein and their structural equivalents, or one of them Or a combination of multiple. The embodiments of the subject described herein can be implemented as one or more computer programs, for example, one or more computer program instruction modules, encoded on a computer program carrier, used to execute or control the data processing device by the data processing device operating. The carrier may be a tangible non-transitory computer storage medium. For example, a computer program carrier may include one or more computer-readable storage media having instructions encoded or stored thereon. The carrier can be a tangible non-transitory computer-readable medium, such as a floppy disk, a magneto-optical disc or optical disc, a solid-state drive, a random access memory (RAM), a read-only memory (ROM), or other media types. Alternatively or additionally, the carrier may be an artificially generated propagated signal, for example, an electrical, optical or electromagnetic signal generated by a machine, which is generated to encode information for transmission to a suitable receiver device for execution by a data processing device. The computer storage medium may be or partly a machine-readable storage device, a machine-readable storage substrate, a random or serial access memory Physical equipment or a combination of one or more of them. Computer storage media is not a transmission signal.

Computer programs can also be called or described as programs, software, software applications, apps, modules, software modules, engines, scripts or codes, and can be written in any form of programming language, including compiled or deductive languages, Description or procedural language; it can be configured in any form, including as a stand-alone program, or as a module, component, engine, subprogram, or other unit suitable for execution in a computing environment, which may include communication data network interconnection One or more computers located in one or more locations.

Computer programs can but do not necessarily correspond to files in the file system. Computer programs can be stored in: part of a file that saves other programs or data, for example, one or more scripts stored in a markup language document; a single file dedicated to the program in question; or multiple coordinated files, for example, Store multiple files of one or more modules, subprograms or code parts.

For example, processors used to execute computer programs include general-purpose microprocessors and special-purpose microprocessors, as well as any one or more processors of any type of digital computer. Generally, the processor will receive instructions and data of a computer program for execution from a non-transitory computer-readable medium coupled to the processor.

The term "data processing device" includes all types of devices, equipment, and machines for processing data, including, for example, programmable processors, computers, or multi-processors or computers. The data processing device may include a dedicated logic circuit, such as FPGA (Field Programmable Gate Array), ASIC (Dedicated Integrated Circuit), or GPU (Graphics Processing Unit). In addition to hardware, the device can also include Including the code that creates the execution environment for computer programs, for example, the code that constitutes the processor firmware, protocol stack, database management system, operating system, or a combination of one or more of them.

The processing and logic flow described in this article can be performed by one or more computers or processors executing one or more computer programs to perform operations on input data and generate output. The processing and logic flow can also be executed by a dedicated logic circuit such as FPGA, ASIC, GPU, or a combination of a dedicated logic circuit and one or more programming computers.

Computers suitable for executing computer programs can be based on general-purpose and/or special-purpose microprocessors, or any other kind of central processing unit. Generally, the central processing unit will receive commands and data from read-only memory and/or random access memory. The components of a computer may include a central processing unit for executing instructions and one or more memory devices for storing instructions and data. The central processing unit and memory can be supplemented with dedicated logic circuits or integrated in dedicated logic circuits.

Generally, the computer will also include or be operatively coupled to one or more large storage area devices to receive data from one or more large storage area devices or transmit data to one or more large storage area devices. The mass storage area device can be, for example, a floppy disk, a magneto-optical disc or optical disc, a solid-state drive, or any other type of non-transitory computer-readable medium. However, the computer does not need to have such equipment. Therefore, the computer can be coupled to one or more large storage devices, such as one or more memories, locally and/or remotely. For example, a computer can include one or more local storage as a component of the computer, or the computer can be coupled to one or more remote locations in a cloud network Storage. In addition, the computer can be embedded in another device, such as a mobile phone, personal digital assistant (PDA), mobile audio or video player, game console, global positioning system (GPS) receiver or, for example, a universal serial bus (USB) Portable storage devices for flash drives, to name a few.

Components can be "coupled" to each other by directly or via one or more intermediary software, such as interchangeably electrically or optically connecting to each other. If one element is integrated into another element, the elements can also be "coupled" to each other. For example, storage elements integrated into the processor (eg, L2 cache memory elements) are "coupled" to the processor.

In order to provide interaction with the user, embodiments of the subject matter described herein may be implemented on a computer or configured to communicate with the computer, the computer having: a display device, for example, an LCD (liquid crystal display) monitor for displaying to the user Information; and an input device through which the user can provide input to the computer, such as a keyboard and a pointing device such as a mouse, trackball, or touchpad. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback, such as visual, auditory, or tactile feedback; and can receive any form of input from the user, including Voice, voice or tactile input. In addition, the computer can interact with the user by sending files to and receiving files from the device used by the user; for example, by sending a web page to the web browser on the user's device in response to a request received from the web browser, Or by interacting with an application (app) running on a user device such as a smart phone or an electronic tablet computer. In addition, the computer It is possible to interact with users by sending text messages or other forms of messages to personal devices (for example, smartphones running messaging applications) in turn and receiving response messages from the users.

This article uses the term "configured as" in relation to systems, devices, and computer program components. For a system of one or more computers configured to perform a specific operation or action, it means that the system has installed on it software, firmware, hardware, or their own software that prompts the system to perform the operation or action during operation. combination. For one or more computer programs configured to perform a specific operation or action, it means that the one or more programs include instructions that when executed by a data processing device cause the device to perform the operation or action. For a dedicated logic circuit configured to perform a specific operation or action, it means that the circuit has electronic logic to perform the operation or action.

Although this document contains many specific implementation details, these should not be construed as limitations on the scope of protection defined by the scope of the patent application itself, but as descriptions of specific features of specific embodiments. Multiple specific features described in the context of multiple separate embodiments herein can also be implemented in combination in a single embodiment. Conversely, various features described in the context of a single embodiment can also be implemented in multiple embodiments individually or in any suitable subcombination. In addition, although the above features can be described as functioning in certain combinations and even initially claimed as such, in some cases, one or more features from the combination may be deleted from the claimed combination, and protection may be claimed Points to a subcombination or variant of a subcombination.

Similarly, although operations are depicted in the diagram in a specific order and in The operations are described in the scope of the patent application, but this should not be understood as: in order to achieve the desired result, these operations are required to be performed in the specific order shown or sequentially, or all the operations shown are required to be performed. In some cases, multiplexing and parallel processing may be advantageous. In addition, the division of various system modules and components in the above embodiments should not be understood as requiring such division in all embodiments, but it should be understood that the program components and systems described can usually be integrated together in a single software product or packaged together. Into multiple software products.

Specific embodiments of the subject matter have been described. Other embodiments are within the scope of the following patent applications. For example, the actions described in the scope of the patent application can be performed in a different order and still achieve the desired result. As an example, the processes depicted in the figures need not require the specific order or sequence shown to achieve the desired result. In some cases, multiplexing and parallel processing may be advantageous.

Claims (10)

A computer-implemented method for managing user key pairs. The method includes: receiving an identity cryptographic chip (ICC) from a computing device in a blockchain network to combine the identity information with the user key pair The request stored in the memory on the ICC, the request is digitally signed with a digital signature, the identity information uniquely identifies the user, and the user key pair is assigned to the user; the ICC is based on the pre-stored The public authorization key in the memory confirms that the digital signature is authentic; the ICC receives the encrypted data containing the identity information and the user key pair; the ICC stores the encrypted data in the memory In the body; the token is generated by the ICC to provide the user with temporary authorization to perform the encryption operation; the encryption operation is performed by the ICC during the limited time authorized by the token; and the result of the encryption operation is transmitted by the ICC. For example, the computer-implemented method of claim 1, further comprising: initializing the ICC by pre-storing the public authorization key and the private authorization key, wherein the public authorization key and the private authorization key are allocated to the The asymmetric key pair of the primary user of ICC. Such as the computer-implemented method of claim 2, where The initialization of the ICC also includes storing an identity authentication code that can be executed to authenticate the user based on the identity information. For example, the computer-implemented method of claim 2 or 3, wherein initializing the ICC further includes: storing a first encryption operation code that can be executed to add the digital signature based on the private authorization key; and storing that can be executed A second encryption operation code for performing file encryption or file decryption based on the user key pair. For example, the computer-implemented method of claim 4, wherein the request for storing the identity information and the user key pair is the first request, the identity information is the first identity information, and the digital signature is the first digital signature , And the computer-implemented method further includes: receiving second identity information and a second request for adding a second digital signature to the file; verifying that the second request can be verified based on a match between the second identity information and the first identity information And based on the first encryption operation code and the private key in the user key pair, adding the second digital signature to the file. For example, the computer-implemented method of claim 4, wherein the request for storing the identity information and the user key pair is the first request, the identity information is the first identity information, and the computer-implemented method further includes: receiving The second identity information and the second request used to encrypt or decrypt files Request; verify that the second request is authentic based on the second identity information matching the first identity information; and based on the second request, the second encryption operation code, and the public key or private key in the user key pair The key performs the encryption or the decryption. For example, the computer-implemented method of claim 1, wherein the identity information is biometric information. For example, the computer-implemented method of claim 1, wherein the memory is programmable read-only memory PROM, electrically erasable PROM, or flash memory, and wherein the identity information and the user key pair are stored in In a separate storage unit of the memory. A system for managing user key pairs, comprising: one or more processors; and one or more computer-readable memory, the computer-readable memory being coupled to and on the one or more processors An instruction is stored, and the instruction can be executed by the one or more processors to execute the method according to any one of claim items 1 to 8. A device for managing a user key pair, the device comprising: a request receiving module, which receives a request for storing identity information and a user key pair in a memory on an identity cryptographic chip (identity cryptographic chip, ICC) , The request is digitally signed with a digital signature, the The identity information uniquely identifies the user, and the user key pair is assigned to the user; the digital signature authentication module determines that the digital signature is authentic based on the public authorization key stored in the memory in advance; receive The module is used to receive the encrypted data including the identity information and the user key pair; the storage module is used to store the encrypted data in the memory; the generation module is used to generate the token to send The user provides a temporary authorization to perform an encryption operation; an execution module to perform the encryption operation during the limited time period authorized by the token; and a transmission module to transmit the result of the encryption operation.

Images